Skip to main content
Question

PPPC Profile randomly fails

  • Dec 9, 2020 10:54 AM UTC
  • 22 replies
  • 257 views

perryd84
Forum|alt.badge.img+14

Hi All,

We use ISL for remote assistance. I added a new line as per ISL supports guidance but then the PPPC profile started to fail on random devices.

I've removed the additional line but the profile is still failing on random devices.

The error in the management log is:
"In the payload (UUID: 5C3CDB37-76DB-4AC6-B82E-ACCF1F2A9345), the required key 'Allowed' is missing."

Now, I'm not using a key that has "allowed" as an option, it's just "Deny" or "Allow standard user to allow" which is what I choose.

Anyone come across this issue before?

22 replies

Forum|alt.badge.img+4

For reference, I've the same issue with TeamViewer and I noted that using big sur it works, while with catalina fails with that error message


Forum|alt.badge.img

Don't suppose you've tracked down a cause, have you?


perryd84
Forum|alt.badge.img+14
  • Author
  • Contributor
  • Feb 23, 2021 4:06 PM UTC

Jamf support told me that it looks like a bug in Jamf and they will look into fixing it in a future release and thats all I got.


Forum|alt.badge.img+2
  • New Contributor
  • Apr 2, 2021 11:45 PM UTC

Just want to drop a me too in here. Our cloud instance was updated to 10.28 and im seeing this in a PCCC profile and in my case it seems to be only failing on 10.15.7 machines so thats fun :( Big Sur and the couple of mojaves I still have kicking around are taking the same profile fine.


Forum|alt.badge.img+6

Are you referring to giving the app access to screen recording via a PPPC policy payload?

I believe the "Allow standard user to allow" key is only valid on Big Sur and any previous OS will reject it producing that error.


Forum|alt.badge.img+3

We also have exactly the same issue. The UUID is different, but the error is the same - Mojave and Big Sur both complete successfully, Catalina comptuers all fail.


Forum|alt.badge.img+3
  • New Contributor
  • Jun 30, 2021 1:03 PM UTC

@Perry84 Any updates on this from Jamf? We've started seeing it also. And it definitely appears to be 10.15.7.


perryd84
Forum|alt.badge.img+14
  • Author
  • Contributor
  • Jul 5, 2021 9:03 AM UTC

No word from Jamf :(

I've just excluded Catalina devices now as we had a massive problem where all the failed profile installs filled up our logs and our Jamf instance basically fell over!!!


bgrant11
Forum|alt.badge.img+4
  • Contributor
  • Nov 5, 2021 7:30 PM UTC

Same here. Only the Cat's fail. 


Forum|alt.badge.img+10
  • Valued Contributor
  • Nov 19, 2021 9:28 AM UTC

Has there been any update on this issue? As we are seeing it with our PPPC configuration profile for allowing Screen Recording for Microsoft Teams.


Forum|alt.badge.img
  • New Contributor
  • Nov 25, 2021 9:18 AM UTC

Any news about this topic?

I'm facing the same issues. With screen recording and listen events.
Jamf Pro 10.33 and macOS 10.15 clients.


perryd84
Forum|alt.badge.img+14
  • Author
  • Contributor
  • Jan 6, 2022 10:46 AM UTC

I managed to find a config profile which enables a bunch of remote support apps. I cant find the original so whoever made it deserves the credit but I'm just sharing it on my github as I cant find the original.

https://github.com/PezzaD84/PPPC-Screensharing


Forum|alt.badge.img+7
  • Contributor
  • Jan 21, 2022 2:39 AM UTC

Did anyone find a way to get this working for Catalina? 

PPPC utility or github's https://github.com/poundbangbash/community-screenrecording-pppc-profile

 

either one doesnt work for Catalina.

This failure results due to the changes Apple made on Screen Recording (Jamf: Screen Capture) 

The function "Let Standard Users Approve" doesnt work it seems.

NOTE: 

When I use PPPC Utility, it shows a "Compatibility Warning" and basically states it will cause error for Screen recording.

 

Anyone found a new way to get around this? 
Our setup:

users are standard users. We dont give out admin creds (obviously).

But users cant "Allow" without admin creds to unlock the little lock on the bottom left.


rcole
Forum|alt.badge.img+7
  • New Contributor
  • Feb 13, 2022 3:11 AM UTC

I managed to find a config profile which enables a bunch of remote support apps. I cant find the original so whoever made it deserves the credit but I'm just sharing it on my github as I cant find the original.

https://github.com/PezzaD84/PPPC-Screensharing


This seems awesome. Do you happen to know if this is still working in Big Sur, Monterey, and Catalina?


rcole
Forum|alt.badge.img+7
  • New Contributor
  • Feb 13, 2022 3:12 AM UTC

Anyone able to find a solution for this?


perryd84
Forum|alt.badge.img+14
  • Author
  • Contributor
  • Feb 13, 2022 8:05 AM UTC

This seems awesome. Do you happen to know if this is still working in Big Sur, Monterey, and Catalina?


Since the latest jamf update the settings instantly change from "allow" to "allow user to allow" so the profile is a little redundant in that your users still have to go tick a box now.


Forum|alt.badge.img+2
  • New Contributor
  • Mar 25, 2022 8:36 PM UTC

Anyone able to find a solution for this?


Create two configuration profiles, one for Big Sur and newer, the other for Catalina and prior. I have a number of these.


Forum|alt.badge.img+10
  • Contributor
  • Apr 13, 2022 5:52 PM UTC

Create two configuration profiles, one for Big Sur and newer, the other for Catalina and prior. I have a number of these.


Can you share what your Catalina profile looks like to create the second one specifically for users on that OS?


Forum|alt.badge.img+2
  • New Contributor
  • Apr 13, 2022 8:36 PM UTC

Can you share what your Catalina profile looks like to create the second one specifically for users on that OS?


You simply cannot use that option on Catalina. There is no workaround except admin permissions (At the time, SAP enterprise privileges app was extremely useful for this problem. https://github.com/SAP/macOS-enterprise-privileges)

I created separate profiles for each OS for the other PPPC permissions the apps needed, like folder access, notifications, events, accessibility, blah blah.

Real solution? Upgrade your Catalina users ASAP.


Forum|alt.badge.img+10
  • Contributor
  • Apr 13, 2022 8:40 PM UTC

You simply cannot use that option on Catalina. There is no workaround except admin permissions (At the time, SAP enterprise privileges app was extremely useful for this problem. https://github.com/SAP/macOS-enterprise-privileges)

I created separate profiles for each OS for the other PPPC permissions the apps needed, like folder access, notifications, events, accessibility, blah blah.

Real solution? Upgrade your Catalina users ASAP.


Got it, thank you for the response! Misunderstood your previous post, thought you were saying you had profile details for Catalina and prior. In the process of getting everyone off of Catalina, but was hoping for a quick solution in the meantime.


Forum|alt.badge.img+2
  • New Contributor
  • Apr 13, 2022 8:46 PM UTC

Got it, thank you for the response! Misunderstood your previous post, thought you were saying you had profile details for Catalina and prior. In the process of getting everyone off of Catalina, but was hoping for a quick solution in the meantime.


Yeah, my answer was a bit off the cuff and not 100% clear, sorry about that!

Good luck with the upgrades, its always a fun time.


Forum|alt.badge.img+5

Are you referring to giving the app access to screen recording via a PPPC policy payload?

I believe the "Allow standard user to allow" key is only valid on Big Sur and any previous OS will reject it producing that error.


Interesting – I wonder if newer OSes also reject it.

Anyone have thoughts on this?

Edit: I'm blind – newer OSes do not reject it, though I do recall having to manually grant Screen Recording permissions for TeamViewer. The other two permissions were applied successfully by the profile.